WordPress plugin · formidable
Is Formidable Forms safe?
Safe on 7.0 or newer.
The current version, 7.0, is past every affected range on record (23 of 23 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 23
- High or critical
- 9
- Exploited
- none
- Current version
- 7.0
- Last updated
- Oct 16, 2026
- Active installs
- 300,000+
Every recorded flaw
- Oct 21, 2026Formidable Forms: Does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requestsCVE-2026-85642 · fixed in 7.0 · reported by WPScanHigh 7.5
- Sep 16, 2026Formidable Forms: Does not prevent a request-derived value from reaching the WordPress shortcode parserCVE-2026-19857 · fixed in 6.35 · reported by WPScanMedium 4.8
- Sep 16, 2026Formidable Forms: Does not restrict who can set the identifier recordingCVE-2026-85641 · fixed in 6.35 · reported by WPScanMedium 4.3
- Aug 26, 2026Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More: Stored Cross-Site ScriptingCVE-2026-18331 · affects up to 6.33.1 · reported by WordfenceHigh 7.2
- Aug 6, 2026Formidable Forms: Does not properly validate the status of a PayPal subscription payment before marking it completeCVE-2026-11361 · fixed in 6.32.1 · reported by WPScanMedium 5.9
- Mar 13, 2026Formidable Forms: A payment integrity bypassCVE-2026-2890 · affects up to 6.28 · reported by WordfenceHigh 7.5
- Mar 13, 2026Formidable Forms: An authorization bypass through user-controlled keyCVE-2026-2888 · affects up to 6.28 · reported by WordfenceMedium 5.3
- Dec 13, 2024Formidable Forms: Missing AuthorizationCVE-2022-45806 · affects up to 5.5.4 · reported by PatchstackMedium 4.3
- Nov 23, 2024Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: POST-Based Reflected Cross-Site ScriptingCVE-2024-11188 · affects up to 6.16.1.2 · reported by WordfenceMedium 6.1
- Nov 21, 2024Formidable Forms: Does not sanitise and escape some of its settingsCVE-2024-9768 · fixed in 6.14.1 · reported by WPScanMedium 4.8
- Oct 16, 2024Formidable Form Builder: Sensitive Data ExposureCVE-2017-20194 · affects up to 2.05.03 · reported by Wordfence1.1% oddsMedium 5.3
- Oct 16, 2024Formidable Form Builder: Stored Cross-Site ScriptingCVE-2017-20192 · fixed in 2.05.03 · reported by Wordfence1.1% oddsHigh 8.3
- Jul 31, 2024Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2024-6725 · affects up to 6.11.1 · reported by WordfenceMedium 4.9
- May 17, 2024Formidable Forms: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-23522 · affects up to 6.7 · reported by PatchstackMedium 5.3
- Feb 5, 2024Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-0660 · affects up to 6.7.2 · reported by WordfenceMedium 6.1
- Jan 16, 2024Formidable Forms: Unserializes user inputCVE-2023-1405 · fixed in 6.2 · reported by WPScanHigh 7.5
- Jan 9, 2024Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2023-6842 · affects up to 6.7 · reported by WordfenceMedium 4.4
- Jan 9, 2024Formidable Forms: HTML injectionCVE-2023-6830 · affects up to 6.7 · reported by WordfenceMedium 6.5
- Jun 27, 2023Formidable Forms: Does not adequately authorize the user or validate the plugin URL in its functionality for installing add-onsCVE-2023-2877 · fixed in 6.3.1 · reported by WPScan22% oddsHigh 8.8
- Mar 27, 2023Formidable Forms: Uses several potentially untrusted headers to determine the IP address of the clientCVE-2023-0816 · fixed in 6.1 · reported by WPScanMedium 6.5
- Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.CVE-2023-24419 · affects up to 5.5.6 · reported by PatchstackHigh 7.1
- Oct 25, 2021Formidable Form Builder: Allows to inject certain HTML Tags like <audio>CVE-2021-24884 · fixed in 4.09.05 · reported by WPScan3.1% oddsCritical 9.6
- Aug 29, 2019The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.CVE-2019-15780 · fixed in 4.02.01 · reported by MITRE2.4% oddsCritical 9.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.